connect() tries to use IPv6 address on IPv4 connections (sometimes), when it doesn’t it gives a ssl error

[yangm97]

I simply copied the sample code, replaced with a dual stack domain (in this case, the telegram bot api) and I have noticed it sometimes throws this error:

connect() to [2600:1f16:59e:b200:dd1c:548d:63ef:7119]:443 failed (101: Network unreachable)

When it does use the correct IP address, I get a ssl error:

lua ssl certificate verify error: (20: unable to get local issuer certificate)

I’m using openresty/openresty:alpine-fat docker image, if it matters.

[yangm97]

Additional info: I’m running docker for mac and my nginx.conf is as follows:

worker_processes  1;
error_log /dev/stderr notice;

env TG_TOKEN;
env SUPERADMINS;
env LOG;
env CHANNEL;
env SOURCE;
env GROUP;
env CORE_LANG;

events {
	worker_connections 32;
}

http {
	access_log /dev/stdout;
	lua_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
	lua_package_path ";;$prefix/lua/?.lua;";
	lua_code_cache off; #only during development
	init_by_lua_file lua/init.lua;
	server {
		listen 80;
		charset utf-8;
		charset_types application/json;
		default_type application/json;
		location /mybot {
			resolver 8.8.8.8;
			content_by_lua_file lua/handler.lua;
		}
	}
}

As you can see, the lua_ssl_trusted_certificate property is set.

[pintsized]

We don't yet currently support ipv6 literals (but we should). This PR is under review: #104

I suspect the SSL issue is unrelated. Are you calling ssl_handshake?

[yangm97]

I didn’t use a literal, the problem was probably due my connection being IPv4 only and resty sometimes getting an IPv6 from the DNS resolver.

[turbo]

That's still very much an issue. The SSL error can be silenced using the ssl verify param, but if the resolver gives an IPv6 address, the request fails. In my example, I'm using Cloudflares 1.1.1.1 instead of Google's 8.8.8.8, but IPv6 should be supported regardless of the resolver.

[hrsantiago]

I still get the same issue using version 0.16.1. Thought it was fixed on PR #104

connect() to [2001:67c:4e8:1033:5:100:0:a]:443 failed (101: Network is unreachable)

Also using docker.

[youanden]

I solved this problem by turning off ipv6 in the resolver:

 resolver 1.1.1.1 ipv6=off;

[xiangnanscu]

I solved this problem by turning off ipv6 in the resolver:

 resolver 1.1.1.1 ipv6=off;

thank dude. you save my day